1c5c4113dSnw /* 2c5c4113dSnw * CDDL HEADER START 3c5c4113dSnw * 4c5c4113dSnw * The contents of this file are subject to the terms of the 5c5c4113dSnw * Common Development and Distribution License (the "License"). 6c5c4113dSnw * You may not use this file except in compliance with the License. 7c5c4113dSnw * 8c5c4113dSnw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9c5c4113dSnw * or http://www.opensolaris.org/os/licensing. 10c5c4113dSnw * See the License for the specific language governing permissions 11c5c4113dSnw * and limitations under the License. 12c5c4113dSnw * 13c5c4113dSnw * When distributing Covered Code, include this CDDL HEADER in each 14c5c4113dSnw * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15c5c4113dSnw * If applicable, add the following below this CDDL HEADER, with the 16c5c4113dSnw * fields enclosed by brackets "[]" replaced with your own identifying 17c5c4113dSnw * information: Portions Copyright [yyyy] [name of copyright owner] 18c5c4113dSnw * 19c5c4113dSnw * CDDL HEADER END 20c5c4113dSnw */ 21c5c4113dSnw /* 22c5866007SKeyur Desai * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23c5c4113dSnw */ 24c5c4113dSnw 25c5c4113dSnw 26c5c4113dSnw /* 27c5c4113dSnw * main() of idmapd(1M) 28c5c4113dSnw */ 29c5c4113dSnw 30c5c4113dSnw #include "idmapd.h" 3171590c90Snw #include <atomic.h> 32c5c4113dSnw #include <signal.h> 33c5c4113dSnw #include <rpc/pmap_clnt.h> /* for pmap_unset */ 34c5c4113dSnw #include <string.h> /* strcmp */ 35c5c4113dSnw #include <unistd.h> /* setsid */ 36c5c4113dSnw #include <sys/types.h> 37c5c4113dSnw #include <memory.h> 38c5c4113dSnw #include <stropts.h> 39c5c4113dSnw #include <netconfig.h> 40c5c4113dSnw #include <sys/resource.h> /* rlimit */ 41c5c4113dSnw #include <rpcsvc/daemon_utils.h> /* DAEMON_UID and DAEMON_GID */ 42c5c4113dSnw #include <priv_utils.h> /* privileges */ 43c5c4113dSnw #include <locale.h> 44c5c4113dSnw #include <sys/systeminfo.h> 45c5c4113dSnw #include <errno.h> 46c5c4113dSnw #include <sys/wait.h> 47c5c4113dSnw #include <sys/time.h> 48c5c4113dSnw #include <zone.h> 49c5c4113dSnw #include <door.h> 50c8e26105Sjp #include <port.h> 51c5c4113dSnw #include <tsol/label.h> 52c5c4113dSnw #include <sys/resource.h> 53c5c4113dSnw #include <sys/sid.h> 54c5c4113dSnw #include <sys/idmap.h> 55bcced03bSjp #include <pthread.h> 56*148c5f43SAlan Wright #include <stdarg.h> 57*148c5f43SAlan Wright #include <assert.h> 58*148c5f43SAlan Wright #include <note.h> 59c5c4113dSnw 60c5c4113dSnw static void term_handler(int); 61c5c4113dSnw static void init_idmapd(); 62c5c4113dSnw static void fini_idmapd(); 63c5c4113dSnw 64c5c4113dSnw idmapd_state_t _idmapdstate; 65c5c4113dSnw 66c5c4113dSnw SVCXPRT *xprt = NULL; 67c5c4113dSnw 68c5c4113dSnw static int dfd = -1; /* our door server fildes, for unregistration */ 69*148c5f43SAlan Wright static boolean_t degraded = B_FALSE; 70c5c4113dSnw 71bcced03bSjp 72bcced03bSjp static uint32_t num_threads = 0; 73bcced03bSjp static pthread_key_t create_threads_key; 74bcced03bSjp static uint32_t max_threads = 40; 75bcced03bSjp 76bcced03bSjp /* 77bcced03bSjp * Server door thread start routine. 78bcced03bSjp * 79bcced03bSjp * Set a TSD value to the door thread. This enables the destructor to 80bcced03bSjp * be called when this thread exits. 81bcced03bSjp */ 82bcced03bSjp /*ARGSUSED*/ 83bcced03bSjp static void * 84bcced03bSjp idmapd_door_thread_start(void *arg) 85bcced03bSjp { 86bcced03bSjp static void *value = 0; 87bcced03bSjp 88bcced03bSjp /* 89bcced03bSjp * Disable cancellation to avoid memory leaks from not running 90bcced03bSjp * the thread cleanup code. 91bcced03bSjp */ 92bcced03bSjp (void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL); 93bcced03bSjp (void) pthread_setspecific(create_threads_key, value); 94bcced03bSjp (void) door_return(NULL, 0, NULL, 0); 95bcced03bSjp 96bcced03bSjp /* make lint happy */ 97bcced03bSjp return (NULL); 98bcced03bSjp } 99bcced03bSjp 100bcced03bSjp /* 101bcced03bSjp * Server door threads creation 102bcced03bSjp */ 103bcced03bSjp /*ARGSUSED*/ 104bcced03bSjp static void 105bcced03bSjp idmapd_door_thread_create(door_info_t *dip) 106bcced03bSjp { 107bcced03bSjp int num; 108bcced03bSjp pthread_t thread_id; 109bcced03bSjp 110bcced03bSjp if ((num = atomic_inc_32_nv(&num_threads)) > max_threads) { 111bcced03bSjp atomic_dec_32(&num_threads); 112bcced03bSjp idmapdlog(LOG_DEBUG, 113bcced03bSjp "thread creation refused - %d threads currently active", 114bcced03bSjp num - 1); 115bcced03bSjp return; 116bcced03bSjp } 117bcced03bSjp (void) pthread_create(&thread_id, NULL, idmapd_door_thread_start, NULL); 118bcced03bSjp idmapdlog(LOG_DEBUG, 119bcced03bSjp "created thread ID %d - %d threads currently active", 120bcced03bSjp thread_id, num); 121bcced03bSjp } 122bcced03bSjp 123bcced03bSjp /* 124bcced03bSjp * Server door thread cleanup 125bcced03bSjp */ 126bcced03bSjp /*ARGSUSED*/ 127bcced03bSjp static void 128bcced03bSjp idmapd_door_thread_cleanup(void *arg) 129bcced03bSjp { 130bcced03bSjp int num; 131bcced03bSjp 132bcced03bSjp num = atomic_dec_32_nv(&num_threads); 133bcced03bSjp idmapdlog(LOG_DEBUG, 134bcced03bSjp "exiting thread ID %d - %d threads currently active", 135bcced03bSjp pthread_self(), num); 136bcced03bSjp } 137bcced03bSjp 138c5c4113dSnw /* 139c5c4113dSnw * This is needed for mech_krb5 -- we run as daemon, yes, but we want 14078b2cb9aSnw * mech_krb5 to think we're root so it can get host/nodename.fqdn 14178b2cb9aSnw * tickets for us so we can authenticate to AD as the machine account 14278b2cb9aSnw * that we are. For more details look at the entry point in mech_krb5 14378b2cb9aSnw * corresponding to gss_init_sec_context(). 14478b2cb9aSnw * 14578b2cb9aSnw * As a side effect of faking our effective UID to mech_krb5 we will use 14678b2cb9aSnw * root's default ccache (/tmp/krb5cc_0). But if that's created by 14778b2cb9aSnw * another process then we won't have access to it: we run as daemon and 14878b2cb9aSnw * keep PRIV_FILE_DAC_READ, which is insufficient to share the ccache 14978b2cb9aSnw * with others. We putenv("KRB5CCNAME=/var/run/idmap/ccache") in main() 15078b2cb9aSnw * to avoid this issue; see main(). 151c5c4113dSnw * 152c5c4113dSnw * Someday we'll have gss/mech_krb5 extensions for acquiring initiator 153c5c4113dSnw * creds with keytabs/raw keys, and someday we'll have extensions to 154c5c4113dSnw * libsasl to specify creds/name to use on the initiator side, and 155c5c4113dSnw * someday we'll have extensions to libldap to pass those through to 156c5c4113dSnw * libsasl. Until then this interposer will have to do. 157c5c4113dSnw * 158c5c4113dSnw * Also, we have to tell lint to shut up: it thinks app_krb5_user_uid() 159c5c4113dSnw * is defined but not used. 160c5c4113dSnw */ 161c5c4113dSnw /*LINTLIBRARY*/ 162c5c4113dSnw uid_t 163c5c4113dSnw app_krb5_user_uid(void) 164c5c4113dSnw { 165c5c4113dSnw return (0); 166c5c4113dSnw } 167c5c4113dSnw 168c5c4113dSnw /*ARGSUSED*/ 169c5c4113dSnw static void 1704edd44c5Sjp term_handler(int sig) 1714edd44c5Sjp { 17271590c90Snw idmapdlog(LOG_INFO, "Terminating."); 173c5c4113dSnw fini_idmapd(); 174c5c4113dSnw _exit(0); 175c5c4113dSnw } 176c5c4113dSnw 17771590c90Snw /*ARGSUSED*/ 17871590c90Snw static void 17971590c90Snw usr1_handler(int sig) 18071590c90Snw { 181*148c5f43SAlan Wright NOTE(ARGUNUSED(sig)) 18271590c90Snw print_idmapdstate(); 18371590c90Snw } 18471590c90Snw 185c5c4113dSnw static int pipe_fd = -1; 186c5c4113dSnw 187c5c4113dSnw static void 1884edd44c5Sjp daemonize_ready(void) 1894edd44c5Sjp { 190c5c4113dSnw char data = '\0'; 191c5c4113dSnw /* 192c5c4113dSnw * wake the parent 193c5c4113dSnw */ 194c5c4113dSnw (void) write(pipe_fd, &data, 1); 195c5c4113dSnw (void) close(pipe_fd); 196c5c4113dSnw } 197c5c4113dSnw 198c5c4113dSnw static int 1994edd44c5Sjp daemonize_start(void) 2004edd44c5Sjp { 201c5c4113dSnw char data; 202c5c4113dSnw int status; 203c5c4113dSnw int devnull; 204c5c4113dSnw int filedes[2]; 205c5c4113dSnw pid_t pid; 206c5c4113dSnw 20778b2cb9aSnw (void) sigset(SIGPIPE, SIG_IGN); 208c5c4113dSnw devnull = open("/dev/null", O_RDONLY); 209c5c4113dSnw if (devnull < 0) 210c5c4113dSnw return (-1); 211c5c4113dSnw (void) dup2(devnull, 0); 212c5c4113dSnw (void) dup2(2, 1); /* stderr only */ 213c5c4113dSnw if (pipe(filedes) < 0) 214c5c4113dSnw return (-1); 215c5c4113dSnw if ((pid = fork1()) < 0) 216c5c4113dSnw return (-1); 217c5c4113dSnw if (pid != 0) { 218c5c4113dSnw /* 219c5c4113dSnw * parent 220c5c4113dSnw */ 221c5c4113dSnw (void) close(filedes[1]); 222c5c4113dSnw if (read(filedes[0], &data, 1) == 1) { 223c5c4113dSnw /* presume success */ 224c5c4113dSnw _exit(0); 225c5c4113dSnw } 226c5c4113dSnw status = -1; 227c5c4113dSnw (void) wait4(pid, &status, 0, NULL); 228c5c4113dSnw if (WIFEXITED(status)) 229c5c4113dSnw _exit(WEXITSTATUS(status)); 230c5c4113dSnw else 231c5c4113dSnw _exit(-1); 232c5c4113dSnw } 233c5c4113dSnw 234c5c4113dSnw /* 235c5c4113dSnw * child 236c5c4113dSnw */ 237c5c4113dSnw pipe_fd = filedes[1]; 238c5c4113dSnw (void) close(filedes[0]); 239c5c4113dSnw (void) setsid(); 240c5c4113dSnw (void) umask(0077); 241c5c4113dSnw openlog("idmap", LOG_PID, LOG_DAEMON); 242479ac375Sdm 243c5c4113dSnw return (0); 244c5c4113dSnw } 245c5c4113dSnw 246c5c4113dSnw 247c5c4113dSnw int 248c5c4113dSnw main(int argc, char **argv) 249c5c4113dSnw { 250c5c4113dSnw int c; 2512b3ecdebSjp struct rlimit rl; 252c5c4113dSnw 25371590c90Snw _idmapdstate.daemon_mode = TRUE; 25471590c90Snw while ((c = getopt(argc, argv, "d")) != -1) { 255c5c4113dSnw switch (c) { 256c5c4113dSnw case 'd': 25771590c90Snw _idmapdstate.daemon_mode = FALSE; 258c5c4113dSnw break; 259c5c4113dSnw default: 260bbf6f00cSJordan Brown (void) fprintf(stderr, 261bbf6f00cSJordan Brown "Usage: /usr/lib/idmapd [-d]\n"); 26271590c90Snw return (SMF_EXIT_ERR_CONFIG); 263c5c4113dSnw } 264c5c4113dSnw } 265c5c4113dSnw 266c5c4113dSnw /* set locale and domain for internationalization */ 267c5c4113dSnw (void) setlocale(LC_ALL, ""); 268c5c4113dSnw (void) textdomain(TEXT_DOMAIN); 269c5c4113dSnw 2707a8a68f5SJulian Pullen idmap_set_logger(idmapdlog); 271c5866007SKeyur Desai adutils_set_logger(idmapdlog); 272479ac375Sdm 273bda89588Sjp if (is_system_labeled() && getzoneid() != GLOBAL_ZONEID) { 27471590c90Snw idmapdlog(LOG_ERR, 27571590c90Snw "with Trusted Extensions idmapd runs only in the " 276bda89588Sjp "global zone"); 277c5c4113dSnw exit(1); 278c5c4113dSnw } 279c5c4113dSnw 2802b3ecdebSjp /* 2812b3ecdebSjp * Raise the fd limit to max 2822b3ecdebSjp */ 2832b3ecdebSjp if (getrlimit(RLIMIT_NOFILE, &rl) != 0) { 2842b3ecdebSjp idmapdlog(LOG_ERR, "getrlimit failed"); 2852b3ecdebSjp } else if (rl.rlim_cur < rl.rlim_max) { 2862b3ecdebSjp rl.rlim_cur = rl.rlim_max; 2872b3ecdebSjp if (setrlimit(RLIMIT_NOFILE, &rl) != 0) 2882b3ecdebSjp idmapdlog(LOG_ERR, 2892b3ecdebSjp "Unable to raise RLIMIT_NOFILE to %d", 2902b3ecdebSjp rl.rlim_cur); 2912b3ecdebSjp } 2922b3ecdebSjp 293c5c4113dSnw (void) mutex_init(&_svcstate_lock, USYNC_THREAD, NULL); 294c5c4113dSnw 29571590c90Snw if (_idmapdstate.daemon_mode == TRUE) { 296c5c4113dSnw if (daemonize_start() < 0) { 2977a8a68f5SJulian Pullen idmapdlog(LOG_ERR, "unable to daemonize"); 298c5c4113dSnw exit(-1); 299c5c4113dSnw } 300c5c4113dSnw } else 301c5c4113dSnw (void) umask(0077); 302c5c4113dSnw 30384decf41Sjp idmap_init_tsd_key(); 30484decf41Sjp 305c5c4113dSnw init_idmapd(); 306c5c4113dSnw 30778b2cb9aSnw /* signal handlers that should run only after we're initialized */ 30878b2cb9aSnw (void) sigset(SIGTERM, term_handler); 30971590c90Snw (void) sigset(SIGUSR1, usr1_handler); 3100dcc7149Snw (void) sigset(SIGHUP, idmap_cfg_hup_handler); 31178b2cb9aSnw 312c5c4113dSnw if (__init_daemon_priv(PU_RESETGROUPS|PU_CLEARLIMITSET, 313c5c4113dSnw DAEMON_UID, DAEMON_GID, 314c5c4113dSnw PRIV_PROC_AUDIT, PRIV_FILE_DAC_READ, 315c5c4113dSnw (char *)NULL) == -1) { 31671590c90Snw idmapdlog(LOG_ERR, "unable to drop privileges"); 317c5c4113dSnw exit(1); 318c5c4113dSnw } 319c5c4113dSnw 320c5c4113dSnw __fini_daemon_priv(PRIV_PROC_FORK, PRIV_PROC_EXEC, PRIV_PROC_SESSION, 321c5c4113dSnw PRIV_FILE_LINK_ANY, PRIV_PROC_INFO, (char *)NULL); 322c5c4113dSnw 32371590c90Snw if (_idmapdstate.daemon_mode == TRUE) 324c5c4113dSnw daemonize_ready(); 325c5c4113dSnw 326c5c4113dSnw /* With doors RPC this just wastes this thread, oh well */ 327c5c4113dSnw svc_run(); 328c5c4113dSnw return (0); 329c5c4113dSnw } 330c5c4113dSnw 331c5c4113dSnw static void 3324edd44c5Sjp init_idmapd() 3334edd44c5Sjp { 334c5c4113dSnw int error; 335bcced03bSjp int connmaxrec = IDMAP_MAX_DOOR_RPC; 336bcced03bSjp 337c5c4113dSnw 33878b2cb9aSnw /* create directories as root and chown to daemon uid */ 33978b2cb9aSnw if (create_directory(IDMAP_DBDIR, DAEMON_UID, DAEMON_GID) < 0) 34078b2cb9aSnw exit(1); 34178b2cb9aSnw if (create_directory(IDMAP_CACHEDIR, DAEMON_UID, DAEMON_GID) < 0) 34278b2cb9aSnw exit(1); 34378b2cb9aSnw 34478b2cb9aSnw /* 34578b2cb9aSnw * Set KRB5CCNAME in the environment. See app_krb5_user_uid() 346e3c2d6aaSnw * for more details. We blow away the existing one, if there is 347e3c2d6aaSnw * one. 34878b2cb9aSnw */ 349e3c2d6aaSnw (void) unlink(IDMAP_CACHEDIR "/ccache"); 350*148c5f43SAlan Wright (void) putenv("KRB5CCNAME=" IDMAP_CACHEDIR "/ccache"); 35178b2cb9aSnw 352c5c4113dSnw if (sysinfo(SI_HOSTNAME, _idmapdstate.hostname, 3534edd44c5Sjp sizeof (_idmapdstate.hostname)) == -1) { 354c5c4113dSnw error = errno; 35571590c90Snw idmapdlog(LOG_ERR, "unable to determine hostname, error: %d", 3564edd44c5Sjp error); 357c5c4113dSnw exit(1); 358c5c4113dSnw } 359c5c4113dSnw 360e8c27ec8Sbaban if ((error = init_mapping_system()) < 0) { 36171590c90Snw idmapdlog(LOG_ERR, "unable to initialize mapping system"); 362e8c27ec8Sbaban exit(error < -2 ? SMF_EXIT_ERR_CONFIG : 1); 363c5c4113dSnw } 364c5c4113dSnw 365bcced03bSjp (void) door_server_create(idmapd_door_thread_create); 366bcced03bSjp if ((error = pthread_key_create(&create_threads_key, 367bcced03bSjp idmapd_door_thread_cleanup)) != 0) { 368bcced03bSjp idmapdlog(LOG_ERR, "unable to create threads key (%s)", 369bcced03bSjp strerror(error)); 370bcced03bSjp goto errout; 371bcced03bSjp } 372bcced03bSjp 373d3a612caSnw xprt = svc_door_create(idmap_prog_1, IDMAP_PROG, IDMAP_V1, connmaxrec); 374c5c4113dSnw if (xprt == NULL) { 37571590c90Snw idmapdlog(LOG_ERR, "unable to create door RPC service"); 376c5c4113dSnw goto errout; 377c5c4113dSnw } 378c5c4113dSnw 3798e228215Sdm if (!svc_control(xprt, SVCSET_CONNMAXREC, &connmaxrec)) { 38071590c90Snw idmapdlog(LOG_ERR, "unable to limit RPC request size"); 3818e228215Sdm goto errout; 3828e228215Sdm } 3838e228215Sdm 384c5c4113dSnw dfd = xprt->xp_fd; 385c5c4113dSnw 386c5c4113dSnw if (dfd == -1) { 38771590c90Snw idmapdlog(LOG_ERR, "unable to register door"); 388c5c4113dSnw goto errout; 389c5c4113dSnw } 3909fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States if ((error = __idmap_reg(dfd)) != 0) { 39171590c90Snw idmapdlog(LOG_ERR, "unable to register door (%s)", 3924edd44c5Sjp strerror(errno)); 393c5c4113dSnw goto errout; 394c5c4113dSnw } 395c5c4113dSnw 396c5c4113dSnw if ((error = allocids(_idmapdstate.new_eph_db, 3974edd44c5Sjp 8192, &_idmapdstate.next_uid, 3984edd44c5Sjp 8192, &_idmapdstate.next_gid)) != 0) { 39971590c90Snw idmapdlog(LOG_ERR, "unable to allocate ephemeral IDs (%s)", 40071590c90Snw strerror(errno)); 4019fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.next_uid = IDMAP_SENTINEL_PID; 4029fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.limit_uid = IDMAP_SENTINEL_PID; 4039fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.next_gid = IDMAP_SENTINEL_PID; 4049fb67ea3Safshin salek ardakani - Sun Microsystems - Irvine United States _idmapdstate.limit_gid = IDMAP_SENTINEL_PID; 405c5c4113dSnw } else { 406c5c4113dSnw _idmapdstate.limit_uid = _idmapdstate.next_uid + 8192; 407c5c4113dSnw _idmapdstate.limit_gid = _idmapdstate.next_gid + 8192; 408c5c4113dSnw } 409c5c4113dSnw 410*148c5f43SAlan Wright if (DBG(CONFIG, 1)) 411*148c5f43SAlan Wright print_idmapdstate(); 412c5c4113dSnw 413c5c4113dSnw return; 414c5c4113dSnw 415c5c4113dSnw errout: 416c5c4113dSnw fini_idmapd(); 417c5c4113dSnw exit(1); 418c5c4113dSnw } 419c5c4113dSnw 420c5c4113dSnw static void 4214edd44c5Sjp fini_idmapd() 4224edd44c5Sjp { 423*148c5f43SAlan Wright (void) __idmap_unreg(dfd); 424c5c4113dSnw fini_mapping_system(); 425c5c4113dSnw if (xprt != NULL) 426c5c4113dSnw svc_destroy(xprt); 427c5c4113dSnw } 428c5c4113dSnw 42971590c90Snw static 43071590c90Snw const char * 43171590c90Snw get_fmri(void) 43271590c90Snw { 43371590c90Snw static char *fmri = NULL; 43471590c90Snw static char buf[60]; 43571590c90Snw char *s; 43671590c90Snw 43771590c90Snw membar_consumer(); 43871590c90Snw s = fmri; 43971590c90Snw if (s != NULL && *s == '\0') 44071590c90Snw return (NULL); 44171590c90Snw else if (s != NULL) 44271590c90Snw return (s); 44371590c90Snw 44471590c90Snw if ((s = getenv("SMF_FMRI")) == NULL || strlen(s) >= sizeof (buf)) 44571590c90Snw buf[0] = '\0'; 44671590c90Snw else 44771590c90Snw (void) strlcpy(buf, s, sizeof (buf)); 44871590c90Snw 44971590c90Snw membar_producer(); 45071590c90Snw fmri = buf; 45171590c90Snw 45271590c90Snw return (get_fmri()); 45371590c90Snw } 45471590c90Snw 45571590c90Snw /* 45671590c90Snw * Wrappers for smf_degrade/restore_instance() 45771590c90Snw * 45871590c90Snw * smf_restore_instance() is too heavy duty to be calling every time we 45971590c90Snw * have a successful AD name<->SID lookup. 46071590c90Snw */ 46171590c90Snw void 462349d5d8fSnw degrade_svc(int poke_discovery, const char *reason) 46371590c90Snw { 46471590c90Snw const char *fmri; 46571590c90Snw 46671590c90Snw membar_consumer(); 46771590c90Snw if (degraded) 46871590c90Snw return; 469349d5d8fSnw 470*148c5f43SAlan Wright idmapdlog(LOG_ERR, "Degraded operation (%s).", reason); 471349d5d8fSnw 47271590c90Snw membar_producer(); 473*148c5f43SAlan Wright degraded = B_TRUE; 47471590c90Snw 47571590c90Snw if ((fmri = get_fmri()) != NULL) 47671590c90Snw (void) smf_degrade_instance(fmri, 0); 477c5866007SKeyur Desai 478c5866007SKeyur Desai /* 479c5866007SKeyur Desai * If the config update thread is in a state where auto-discovery could 480c5866007SKeyur Desai * be re-tried, then this will make it try it -- a sort of auto-refresh. 481c5866007SKeyur Desai */ 482c5866007SKeyur Desai if (poke_discovery) 483c5866007SKeyur Desai idmap_cfg_poke_updates(); 48471590c90Snw } 48571590c90Snw 48671590c90Snw void 48771590c90Snw restore_svc(void) 48871590c90Snw { 48971590c90Snw const char *fmri; 49071590c90Snw 49171590c90Snw membar_consumer(); 49271590c90Snw if (!degraded) 49371590c90Snw return; 49471590c90Snw 49571590c90Snw if ((fmri = get_fmri()) == NULL) 49671590c90Snw (void) smf_restore_instance(fmri); 49771590c90Snw 49871590c90Snw membar_producer(); 499*148c5f43SAlan Wright degraded = B_FALSE; 500479ac375Sdm 501349d5d8fSnw idmapdlog(LOG_NOTICE, "Normal operation restored"); 50271590c90Snw } 50371590c90Snw 5047a8a68f5SJulian Pullen 5057a8a68f5SJulian Pullen /* printflike */ 506c5c4113dSnw void 5077a8a68f5SJulian Pullen idmapdlog(int pri, const char *format, ...) { 508c5c4113dSnw va_list args; 509c5c4113dSnw 510*148c5f43SAlan Wright va_start(args, format); 511*148c5f43SAlan Wright (void) vfprintf(stderr, format, args); 512*148c5f43SAlan Wright (void) fprintf(stderr, "\n"); 513*148c5f43SAlan Wright va_end(args); 51471590c90Snw 51571590c90Snw /* 51671590c90Snw * We don't want to fill up the logs with useless messages when 51771590c90Snw * we're degraded, but we still want to log. 51871590c90Snw */ 519*148c5f43SAlan Wright if (degraded) 52071590c90Snw pri = LOG_DEBUG; 52171590c90Snw 522*148c5f43SAlan Wright va_start(args, format); 523*148c5f43SAlan Wright vsyslog(pri, format, args); 524*148c5f43SAlan Wright va_end(args); 5257a8a68f5SJulian Pullen } 5267a8a68f5SJulian Pullen 527*148c5f43SAlan Wright static void 528*148c5f43SAlan Wright trace_str(nvlist_t *entry, char *n1, char *n2, char *str) 5297a8a68f5SJulian Pullen { 530*148c5f43SAlan Wright char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */ 531*148c5f43SAlan Wright 532*148c5f43SAlan Wright (void) strlcpy(name, n1, sizeof (name)); 533*148c5f43SAlan Wright if (n2 != NULL) 534*148c5f43SAlan Wright (void) strlcat(name, n2, sizeof (name)); 535*148c5f43SAlan Wright 536*148c5f43SAlan Wright (void) nvlist_add_string(entry, name, str); 5377a8a68f5SJulian Pullen } 5387a8a68f5SJulian Pullen 539*148c5f43SAlan Wright static void 540*148c5f43SAlan Wright trace_int(nvlist_t *entry, char *n1, char *n2, int64_t i) 5417a8a68f5SJulian Pullen { 542*148c5f43SAlan Wright char name[IDMAP_TRACE_NAME_MAX+1]; /* Max used is only about 11 */ 543*148c5f43SAlan Wright 544*148c5f43SAlan Wright (void) strlcpy(name, n1, sizeof (name)); 545*148c5f43SAlan Wright if (n2 != NULL) 546*148c5f43SAlan Wright (void) strlcat(name, n2, sizeof (name)); 547*148c5f43SAlan Wright 548*148c5f43SAlan Wright (void) nvlist_add_int64(entry, name, i); 5497a8a68f5SJulian Pullen } 5507a8a68f5SJulian Pullen 551*148c5f43SAlan Wright static void 552*148c5f43SAlan Wright trace_sid(nvlist_t *entry, char *n1, char *n2, idmap_sid *sid) 553*148c5f43SAlan Wright { 554*148c5f43SAlan Wright char *str; 555*148c5f43SAlan Wright 556*148c5f43SAlan Wright (void) asprintf(&str, "%s-%u", sid->prefix, sid->rid); 557*148c5f43SAlan Wright if (str == NULL) 558*148c5f43SAlan Wright return; 559*148c5f43SAlan Wright 560*148c5f43SAlan Wright trace_str(entry, n1, n2, str); 561*148c5f43SAlan Wright free(str); 562*148c5f43SAlan Wright } 563*148c5f43SAlan Wright 564*148c5f43SAlan Wright static void 565*148c5f43SAlan Wright trace_id(nvlist_t *entry, char *fromto, idmap_id *id, char *name, char *domain) 566*148c5f43SAlan Wright { 567*148c5f43SAlan Wright trace_int(entry, fromto, IDMAP_TRACE_TYPE, (int64_t)id->idtype); 568*148c5f43SAlan Wright if (IS_ID_SID(*id)) { 569*148c5f43SAlan Wright if (name != NULL) { 570*148c5f43SAlan Wright char *str; 571*148c5f43SAlan Wright 572*148c5f43SAlan Wright (void) asprintf(&str, "%s%s%s", name, 573*148c5f43SAlan Wright domain == NULL ? "" : "@", 574*148c5f43SAlan Wright domain == NULL ? "" : domain); 575*148c5f43SAlan Wright if (str != NULL) { 576*148c5f43SAlan Wright trace_str(entry, fromto, IDMAP_TRACE_NAME, str); 577*148c5f43SAlan Wright free(str); 578*148c5f43SAlan Wright } 579*148c5f43SAlan Wright } 580*148c5f43SAlan Wright if (id->idmap_id_u.sid.prefix != NULL) { 581*148c5f43SAlan Wright trace_sid(entry, fromto, IDMAP_TRACE_SID, 582*148c5f43SAlan Wright &id->idmap_id_u.sid); 583*148c5f43SAlan Wright } 584*148c5f43SAlan Wright } else if (IS_ID_POSIX(*id)) { 585*148c5f43SAlan Wright if (name != NULL) 586*148c5f43SAlan Wright trace_str(entry, fromto, IDMAP_TRACE_NAME, name); 587*148c5f43SAlan Wright if (id->idmap_id_u.uid != IDMAP_SENTINEL_PID) { 588*148c5f43SAlan Wright trace_int(entry, fromto, IDMAP_TRACE_UNIXID, 589*148c5f43SAlan Wright (int64_t)id->idmap_id_u.uid); 590*148c5f43SAlan Wright } 591*148c5f43SAlan Wright } 592*148c5f43SAlan Wright } 593*148c5f43SAlan Wright 594*148c5f43SAlan Wright /* 595*148c5f43SAlan Wright * Record a trace event. TRACE() has already decided whether or not 596*148c5f43SAlan Wright * tracing is required; what we do here is collect the data and send it 597*148c5f43SAlan Wright * to its destination - to the trace log in the response, if 598*148c5f43SAlan Wright * IDMAP_REQ_FLG_TRACE is set, and to the SMF service log, if debug/mapping 599*148c5f43SAlan Wright * is greater than zero. 600*148c5f43SAlan Wright */ 601*148c5f43SAlan Wright int 602*148c5f43SAlan Wright trace(idmap_mapping *req, idmap_id_res *res, char *fmt, ...) 6037a8a68f5SJulian Pullen { 604*148c5f43SAlan Wright va_list va; 605*148c5f43SAlan Wright char *buf; 606*148c5f43SAlan Wright int err; 607*148c5f43SAlan Wright nvlist_t *entry; 608*148c5f43SAlan Wright 609*148c5f43SAlan Wright assert(req != NULL); 610*148c5f43SAlan Wright assert(res != NULL); 611*148c5f43SAlan Wright 612*148c5f43SAlan Wright err = nvlist_alloc(&entry, NV_UNIQUE_NAME, 0); 613*148c5f43SAlan Wright if (err != 0) { 614*148c5f43SAlan Wright (void) fprintf(stderr, "trace nvlist_alloc(entry): %s\n", 615*148c5f43SAlan Wright strerror(err)); 616*148c5f43SAlan Wright return (0); 617*148c5f43SAlan Wright } 618*148c5f43SAlan Wright 619*148c5f43SAlan Wright trace_id(entry, "from", &req->id1, req->id1name, req->id1domain); 620*148c5f43SAlan Wright trace_id(entry, "to", &res->id, req->id2name, req->id2domain); 621*148c5f43SAlan Wright 622*148c5f43SAlan Wright if (IDMAP_ERROR(res->retcode)) { 623*148c5f43SAlan Wright trace_int(entry, IDMAP_TRACE_ERROR, NULL, 624*148c5f43SAlan Wright (int64_t)res->retcode); 625*148c5f43SAlan Wright } 626*148c5f43SAlan Wright 627*148c5f43SAlan Wright va_start(va, fmt); 628*148c5f43SAlan Wright (void) vasprintf(&buf, fmt, va); 629*148c5f43SAlan Wright va_end(va); 630*148c5f43SAlan Wright if (buf != NULL) { 631*148c5f43SAlan Wright trace_str(entry, IDMAP_TRACE_MESSAGE, NULL, buf); 632*148c5f43SAlan Wright free(buf); 633*148c5f43SAlan Wright } 634*148c5f43SAlan Wright 635*148c5f43SAlan Wright if (DBG(MAPPING, 1)) 636*148c5f43SAlan Wright idmap_trace_print_1(stderr, "", entry); 637*148c5f43SAlan Wright 638*148c5f43SAlan Wright if (req->flag & IDMAP_REQ_FLG_TRACE) { 639*148c5f43SAlan Wright /* Lazily allocate the trace list */ 640*148c5f43SAlan Wright if (res->info.trace == NULL) { 641*148c5f43SAlan Wright err = nvlist_alloc(&res->info.trace, 0, 0); 642*148c5f43SAlan Wright if (err != 0) { 643*148c5f43SAlan Wright res->info.trace = NULL; /* just in case */ 644*148c5f43SAlan Wright (void) fprintf(stderr, 645*148c5f43SAlan Wright "trace nvlist_alloc(trace): %s\n", 646*148c5f43SAlan Wright strerror(err)); 647*148c5f43SAlan Wright nvlist_free(entry); 648*148c5f43SAlan Wright return (0); 649*148c5f43SAlan Wright } 650*148c5f43SAlan Wright } 651*148c5f43SAlan Wright (void) nvlist_add_nvlist(res->info.trace, "", entry); 652*148c5f43SAlan Wright /* Note that entry is copied, so we must still free our copy */ 653*148c5f43SAlan Wright } 654*148c5f43SAlan Wright 655*148c5f43SAlan Wright nvlist_free(entry); 656*148c5f43SAlan Wright 657*148c5f43SAlan Wright return (0); 658c5c4113dSnw } 659